No password, anywhere

A magic link. Emailed to you, opens straight into your account. Nothing to remember.

A login code. The same idea for when you are moving between devices and cannot follow a link.

Google, Apple, Facebook or LinkedIn. Standard OAuth. PodSwap receives an identity, not a credential.

By leaving 5 real comments through the app, on Instagram and on TikTok alike.

Proving ownership by commenting is not a workaround for the lack of an API. It is the only proof that cannot be handed over: a password can be shared, an OAuth token can be issued by anyone with the password, but comments appearing under a post from the account in question can only be left by someone holding the phone. It also means the verification step is itself useful work — you have given five real creators a comment by the time you are verified.

TikTok used to be different — ownership was proved with a short code placed in your bio and read back from your public profile. That challenge is gone, and both platforms now run one wizard with one definition of verified.

TikTok releases an abandoned handle for reclaim after 30 days, which Instagram does not. So ownership is re-checked against the stable identifier behind the handle, and revoked when that identifier moves — even though the handle still matches.

A bio code could never have caught that: the new owner simply would not have the code, which reads as "unverified" rather than as "this is a different person".